Information Management Assessment

Northern Ireland Office

Reviewed February 2016

Published October 2016

Working with government to raise standards in information management Statement of commitment

The following statement was provided by the Permanent Secretary of the Northern Ireland Office (NIO). It is published on the department’s external webpages.

The NIO announces a review of processes and systems to meet its corporate obligations

The Northern Ireland Office recognises the importance of meeting its corporate obligations to effectively manage, protect and exploit its information.

To show the strength of the department’s commitment, I have asked The National Archives to review our processes and systems. The National Archives regularly conducts assessments of information management practices and compliance within government departments.

The report they produce will help me to support all aspects of knowledge and information management across the department. It will help to make sure that our information, knowledge and records are appropriately captured, managed and preserved, and information risks and sensitivities are appropriately handled.

Sir Jonathan Stephens KCB Permanent Secretary, Northern Ireland Office

IMA background

The Information Management Assessment (IMA) entailed a detailed review of supporting documentation followed by interviews with senior staff, specialists and practitioners in the department’s London and Belfast offices. These were conducted between 1 and 4 February 2016.

The following report provides a summary of good practice and risks identified. IMA reports and departmental action plans are published on The National Archives’ website at:

nationalarchives.gov.uk/information-management/our-services/ima-reports-action-plans.htm Glossary

ALBs – Arm’s Length Bodies DRO – Departmental Records Officer DROID – Digital Record and Object Identifier EDRM – Electronic Document and Records Management FOI – Freedom of Information HP – Hewlett Packard IAC – Information Assurance Coordinator IAO – Information Asset Owner IAR – Information Asset Register IDAR – Information and Data Asset Register IMA – Information Management Assessment IMC – Information Management Consultant ITAC – IT Assist Confidential KIM – Knowledge and Information Management LIM – Local Information Manager NIO – Northern Ireland Office PST – Personal Storage Table R&IM – Records and Information Management SIRO – Senior Information Risk Owner TRIM – NIO’s EDRM system Key findings of the assessment

1 The value of information

| Performance rating | Communicating and realising value | Good practice | |--------------------|-----------------------------------|---------------| | Managing information as an asset | Satisfactory |

- The Northern Ireland Office (NIO) has a strong culture of information and records management and also information security. Responsibilities of staff are clearly set out in the Information Management Policy and associated guidance, and staff recognised the importance of protecting and managing information appropriately. There is increasing recognition of the importance of information and records management at senior levels. The Departmental Records Officer (DRO), also the Deputy Director for the Business Delivery Group, attends Board meetings. The Permanent Secretary takes a particular interest in the records of the department. The Information Management Assessment (IMA) statement of commitment was published externally and this is another strong indicator of his support for information and records management.

- NIO is facing a significant cultural change in the next year with a move to more open and flexible working: it needs to take steps to ensure that it maintains its strong approach to information and records management and information security throughout this period and beyond. See recommendations 2 and 5.

- NIO’s draft Knowledge and Information Management (KIM) Strategy for 2015-20 is succinct and clearly reflects goals around the protection, management and exploitation of NIO’s information. Sign-off of the strategy has been held back to enable NIO to incorporate findings from this IMA. NIO needs to ensure that this KIM Strategy is aligned with any future IT Strategy. See recommendation 2.

- Robust and effective procedures are in place for dealing with Freedom of Information (FOI) requests and the shared service arrangement with the Wales Office is working well.

- NIO has made a good start on building a process for the management of its information assets. The responsibilities of the Information Asset Owner (IAO) role are well defined and the role is senior enough to have influence and responsibility. NIO has also developed a straightforward Information and Data Asset Register (IDAR) template and the examples reviewed in this IMA had been populated well. NIO should build on the work it has already done by fully embedding this across the organisation, including developing a description of an information asset and improving training for IAOs. See recommendation 1.

2 Digital information and supporting technology

| Performance rating | Development area | |--------------------|------------------| | Supporting information through technology | Development area | | Digital continuity and IT change | Development area |

- NIO is facing a major change in its technology environment as it moves to a new IT platform, with support provided jointly by Common Technology Services (based within the Cabinet Office) and IT Assist. While this change brings with it some clear benefits, it also raises considerable risks around the ongoing success of TRIM (NIO’s electronic document and records management system) and the impact of mobile technology on a department used to working in a tightly controlled environment (see below). NIO needs to ensure that these risks are recognised and monitored as part of the NIO risk management framework and mitigated through communications, training, guidance and technical solutions. See recommendation 2.

- Take-up of TRIM at NIO is good and work to improve and enhance the system (including improving and opening up the file plan structure, enabling auto disposal and plans to upgrade to new and better versions of the product) is to be commended. NIO also took a clear decision to continue using TRIM as this system supports its requirements for information and records management. There was a lot of positivity for the system among staff, who recognised that it was a good tool and that there were benefits in keeping corporate information in a shared space. However, the move to the new IT platform will make Google Docs and Google Drive available for staff to use, although for the time being these will not integrate with TRIM. There is a very real risk that TRIM’s status as the main system for corporate information will be undermined, with staff preferring to use Google Docs and Google Drive. NIO should take steps to ensure that it continues to provide a supportive environment for the management of digital information and records as it moves to the new IT platform. See recommendation 2.

- NIO does not have legacy information fragmented across many different systems, as in some departments. However, legacy shared drives do exist and NIO needs to develop a strategy/plan for how it will handle these. This should include identifying what information the drives contain, deciding which records are of value and need to be kept, and applying disposal. The earliest information in TRIM is over ten years old and NIO needs to monitor this information to ensure that it remains complete, available and usable. NIO should also develop an approach for the appraisal, selection, sensitivity review and transfer of legacy information on shared drives and older information in TRIM. See recommendations 3 and 7.

3 Information risk, governance and oversight

| Performance rating | Development area | |--------------------|------------------| | Recognising information risk | Development area | | Establishing control | Satisfactory | | Providing guidance | Satisfactory | | Measuring Impact | Development area |

- NIO’s approach to information risk, particularly risks relating to information management, appears fragmented. Information risk in its wider sense is not necessarily understood across the organisation or recognised at Board level. Many staff we spoke to thought information risk was purely concerned with the security and protection of information rather than the wider issue of information availability and use. NIO is facing some serious risks to the availability and security of its information (see section 2) as it moves to a new IT platform and more open and flexible working. We found little evidence to suggest that information risks are being routinely identified and documented. NIO needs to ensure that information risks are understood across the organisation, especially at Board level, and are recorded, monitored and mitigated as part of the risk management framework. See recommendation 4.

- The Records and Information Management (R&IM) team provides a good service to the business and our interviews revealed a lot of internal support for the team. There is a clear plan in place for KIM – the KIM strategy includes an action timeline of all activities for 2016 and this is reflected in the R&IM business plan. At present, the R&IM team has sufficient capability to carry out its planned activities and this should continue as NIO upgrades TRIM and moves towards a new IT environment. See recommendation 5.

- NIO has good policies and guidance in place for information management. As it moves towards a new IT environment and more open and flexible working, NIO needs to update these policies, guidance and training accordingly. It would also benefit from exploring ways of measuring compliance with policy and guidance as there is no formal process in place for this at present. See recommendation 5.

4 Records, review and transfer

| Performance rating | | |-------------------|---| | Oversight of records and selection | Satisfactory | | Implementing disposal decisions | Development area |

- The Departmental Records Officer (DRO) and Records and Information Management team (R&IM) are together fulfilling all aspects of the DRO role as set out in The National Archives’ guidance.

- NIO has three very knowledgeable and experienced part-time file reviewers who carry out appraisal and selection and sensitivity review of paper files to be transferred to The National Archives. They are all former senior civil servants and have a deep and nuanced understanding of the issues and potential sensitivities. The National Archives' Information Management Consultant recognised the standard of NIO’s appraisal and selection work as ‘excellent’ and closure applications are usually approved without challenge. However, there is no overall departmental guidance for appraisal and selection or sensitivity review and NIO need to capture and document the knowledge of these reviewers. See recommendation 6.

- Despite having good processes in place for its digital records NIO is not currently appraising, selecting, sensitivity reviewing or transferring its digital records and is not yet able to apply auto-disposal to TRIM. The age of some of its digital records (some information in TRIM is over ten years old and there is also legacy information on shared drives that predates TRIM) means it should tackle this as soon as possible. Liaising with The National Archives and learning from other government departments, NIO needs to develop an approach for the appraisal and selection and sensitivity review of digital information and ensure that it acquires new skills within the team to be able to carry out this work. See recommendation 7.

- NIO is currently slightly behind in its transition to the 20-year rule. The increase in volume of paper files from the late 1980s onwards will exacerbate this issue and NIO could fall further behind as a result (see section 4.1). NIO is starting to think about how to address this and has a plan to catch up, which will be presented to the Advisory Council for approval. It has also been liaising with the Foreign and Commonwealth Office (FCO) to find out more about their approach to dealing with backlogs. NIO should also liaise with The National Archives on this: we shall be able to provide further advice and support. See recommendation 6.

## Highlights table

The following are among the areas of good practice identified at the time of the assessment. They include systems and approaches that other government organisations may find helpful in mitigating information and records management related risks, some of which will be included in the IMA Good Practice Report:

| Highlights of the 2016 IMA | |---------------------------| | The Deputy Director for the Business Delivery Group is the Northern Ireland Office’s (NIO) Departmental Records Officer (DRO) and attends Board meetings. This arrangement has been beneficial for NIO, for example in prioritising information and records management issues, such as the need to retain TRIM. | | NIO has well-organised and robust processes in place for handling Freedom of Information (FOI) requests. The department currently also provides a shared service for FOI to the Wales Office and the work is shared between two staff members, one of whom is based in Belfast and the other in London. Requests come into the central FOI team but are then passed to the relevant business area. Requests are tracked using a word document saved on TRIM which, given the size of the department and the relatively low number of requests, seems sufficient. The tracking document is circulated to the Permanent Secretary on a weekly basis. The FOI team is on hand to give business areas advice and to monitor the progress of the requests. FOI is taken seriously by business areas. For example, one interviewee felt that there is a good FOI culture and a competitive attitude towards the FOI statistics. All records of requests are held on TRIM. | | Business areas are expected to populate an Information and Data Asset Register (IDAR). We were provided with the template prior to the IMA and | were able to view two completed examples. Overall the template is very good and includes the headings that we would expect, including business requirements and retention. The completed examples we viewed had been populated well. We are particularly pleased to note that sensible groupings of information assets have been listed, rather than just listing assets at a system level or just listing those that contain personal data.

Take-up of TRIM is better at NIO than we often see for traditional Electronic Document and Records Management (EDRM) systems, which is probably largely due to the fact that NIO has, up to now, eliminated or controlled alternative areas for storing information. During the assessment we found a lot of positivity towards TRIM from users, despite a few issues. Staff generally find it easy to save documents and emails into TRIM. There was recognition that it is a good tool and of the benefit of keeping important corporate information in a shared space. A user from a policy area said that it was ‘good to be able to access historical documents’ and had asked for a link in the file plan to previous work on a Bill so they could learn from these records. One or two interviewees said they disliked it at first but, once they got used to using it, they found it helpful. One interviewee compared TRIM to an EDRM that they had used in another government department which had been difficult to search, saying that TRIM was ‘much easier to use’.

Following on from recommendations of the audit in 2014, the DRO was able to successfully secure additional resource. This included separating out a more strategic role at Band A level with responsibility for information and records management policy and guidance, and a role to provide additional support for TRIM.

At the time of the IMA the Records & Information Management team was about to take on an apprentice at Band E for 18 months. This was successfully tried in the FOI team, providing additional resource for the team and a career development opportunity. The interviews revealed a lot of internal support for the R&IM team and the service that they provide. Staff felt that they could either pick up the phone to get help or just speak to someone from the R&IM team. The TRIM administrator, along with her colleague, prioritises requests for help from the business, dealing with them quickly and effectively.

NIO has three very knowledgeable and experienced part-time file reviewers. They are all former senior civil servants and have a deep and nuanced understanding of the issues and potential sensitivities. Appraisal decisions are quality-checked by the Head of R&IM. The National Archives’ Information Management Consultant (IMC) recognised the standard of NIO’s appraisal and selection work as ‘excellent’ and is generally able to approve selection decisions without need for re-review.

## Recommendations to address risk areas

### Recommendation 1

**Northern Ireland Office (NIO) should build on the good work it has already done to establish a process for information asset management by fully embedding this across the organisation**

This would be supported by:

- defining what an information asset is to the department and including this in the documentation for Information Asset Owners (IAO)
- ensuring that business areas are completing their Information and Data Asset Register (IDAR) as directed
- considering how the Records and Information Management team could use the populated IDARs to gain a greater sense of what business areas regard as their key groupings of valuable information
- raising staff awareness of the purpose of the IAO role, possibly via the intranet
- improving training provision for IAOs, including making further use of The National Archives’ IAO training.

### Recommendation 2

**NIO should take steps to ensure that it continues to provide a supportive environment for the management of digital information and records as it moves to a new IT platform**

This would be supported by:

- recognising the risk of staff moving away from the TRIM EDRM system because of the availability of Google Docs/Drive and the lack of integration between TRIM and Google at Board level; and managing and mitigating this as part of the NIO risk management framework
- considering the possibility of limiting access to Google Docs/Drive until integration with TRIM is possible • giving the R&IM team oversight of Google Drive so it can monitor use • making it absolutely clear that staff are to continue to store records in TRIM through communications, policy, guidance and training • ensuring that managers support and promote this • moving to a version of TRIM that integrates with Google as quickly as is technically possible • ensuring that TRIM is accessible on mobile devices • aligning the Knowledge and Information Management (KIM) Strategy with any future IT strategy • implementing automatic disposal within TRIM • considering what statistics it needs to monitor usage of existing systems, as well as newly-available applications such as Google Docs and Google Drive, and ensuring that it has arrangements in place for IT Assist and Cabinet Office to provide these to them • reminding staff about guidance on naming conventions • reviewing the approach to deletion for shared mailboxes • using the KIM strategy to provide direction for this work.

Recommendation 3

NIO should take steps to ensure that its digital information remains complete, available and usable for as long as it needs it to be

This would be supported by:

• ensuring that it has oversight of Microsoft Outlook, personal and shared drives (either directly or indirectly), as well as other systems such as Google Docs/Drive • monitoring information in TRIM in terms of whether it remains complete, available and usable • developing a strategy/plan for dealing with the shared drives including identifying what information the drives contain, deciding which records are of value and need to be kept and applying disposal • running DROID (The National Archives’ file profiling tool) over its shared drives to get an idea of age and format and, at a high level, what the records may cover. It would also help NIO to identify duplicate or redundant records • continuing regular contact between NIO, IT Assist and the Cabinet Office and strengthening this relationship as NIO moves towards its new IT arrangement; ensuring that the R&IM team is able to contribute towards IT decisions/projects that have an impact on information and records management • defining its requirements for its digital information and setting out how it intends to meet these.

### Recommendation 4

NIO needs to ensure that information risks are properly understood across the organisation – especially at Board level – and are recorded, monitored and mitigated as part of the risk management framework.

This would be supported by:

- providing a more detailed description of information risk with examples and communicating this to staff, particularly IAOs and project managers
- looking at how other departments have done this, in particular the Ministry of Defence, Home Office and Department for Education
- ensuring that information risks are being identified and recorded on risk registers as part of the risk management process
- monitoring and mitigating risks to the availability and security of NIO’s information as it moves to more flexible and open working as part of the NIO risk management framework; ensuring that the Board has sight of these as necessary
- mitigating these risks through communications and updated guidance and training for staff that reflect the new IT environment and emphasise the continued need to protect and manage information appropriately
- liaising with The National Archives to arrange an information security Board-level briefing to help raise awareness of information risk and information security, including cyber threats.

### Recommendation 5

As it moves towards a new IT environment and more open and flexible working, NIO needs to update its information and records management policies, guidance and training accordingly, and ensure that it has the right staff in place to support these. It would also benefit from exploring ways of measuring compliance with policy and guidance.

This would be supported by:

- ensuring that Local Information Managers’ (LIM) responsibilities are included in their annual performance agreements

- using LIMs help to promote and monitor the use of TRIM as well as the use of new systems, Google Docs and Google Drive

- training LIMs on new versions of TRIM and other systems as necessary, making them aware of updated guidance and encouraging them to promote this to staff in their business areas

- reminding staff about the existence of information and records management guidance, possibly through communications on the NIO intranet and via LIMs – particularly the Information Management Policy and high-level guidance on what records to keep

- publishing retention schedules in line with the recommendations in Sir Alex Allan’s Report on Records Review 2014 and The National Archives’ guidance

- updating guidance and policies to reflect the move to a new IT environment and the move to more flexible working. For example, the Information Management Policy needs to make it clear that staff are to save records to TRIM rather than keeping them in Google Drive

- making sure guidance around the security and protection of information includes clear rules around the use of mobile technology and on working outside the office

- reviewing the practice of line managers providing induction training in information and records management to see how well it is working, and considering what additional support the R&IM team can provide to line managers and LIMs on this

- providing adequate facilities for future TRIM training

- considering what other government departments, such as HM Treasury, have done to establish a process for benchmarking/measuring compliance and thinking about how they could develop an approach to fit NIO.

- Using the KIM strategy to provide direction for this work.

Recommendation 6

NIO should review its current approach to appraisal, selection, sensitivity review and transfer of its paper files to ensure that it can keep pace with the transition to the 20-year rule

This would be supported by:

- continuing to prioritise and carry out this work
- capturing the knowledge of NIO’s existing reviewers and documenting its selection criteria.
- further exploring macro approaches to appraisal to speed up and streamline the process of paper appraisal and selection.
- liaising with its Information Management Consultant (IMC), who will be able to provide further advice and support.

Recommendation 7 NIO needs to start developing an approach for the appraisal, selection, sensitivity review and transfer of its digital information

This would be supported by:

- liaising with its IMC on methods of digital appraisal and learning from other government departments’ work on this
- following the work that The National Archives and other government departments are doing on digital sensitivity review, particularly around tools to assist the process
- reading the research report *The application of technology-assisted review to born-digital records transfer, Inquiries and beyond*, recently published by The National Archives
- signing up for The National Archives digital transfer training
- acquiring and using DROID
- using the legacy information on shared drives that predates TRIM as a starting point for this work. 1 The value of information

1.1 Communicating and realising value

Goal: The organisation establishes information’s value in principle and supports its realisation in practice

Establishing the importance of information

The Northern Ireland Office (NIO) currently has a strong culture of information and records management and information security. The Information Management Policy and associated guidance clearly sets out the responsibilities of staff, managers and the Records and Information Management (R&IM) team for the information NIO creates and holds. According to the Information Management Policy:

The NIO expects that staff will:

- treat information as a corporate asset
- take responsibility for the information they create, capture or maintain
- play an active role in managing the information of their business unit
- make information accessible to colleagues
- protect corporate information from misuse or inappropriate disclosure.

NIO managers will:

- take responsibility for the management of information created and used in their business areas

- ensure the information has appropriate access and security permissions

- encourage sharing of information and knowledge by and among their teams

- ensure knowledge transfer through the Headstart starters and leavers scheme. The Records & Information Management Team will:

- maintain corporate paper and electronic records and information systems (TRIM)

- ensure capture and transfer of the public record

- support staff through training and guidance.

Staff interviewed clearly recognised the importance of protecting information and keeping it secure, as well as the need to keep records within the designated systems. For example, many interviewees spoke about giving records meaningful titles and saving them in well-structured sections of the file plan within TRIM (NIO’s system for electronic document and records management), so that they and other staff can easily find and use these records. One interviewee described the role of records management as ‘making sure that key conversations are saved to TRIM’. All staff we spoke to had completed the Responsible for Information e-learning and several reported scoring 100%.

The Deputy Director for the Business Delivery Group is NIO’s Departmental Records Officer (DRO) and attends Board meetings. This arrangement has been beneficial for NIO – for example, in prioritising information and records management issues, such as the need to retain TRIM. We also received good indications that information and records matters are being raised at Board level: for example, the options paper on email deletion (see section 2.1). This is good practice. As one senior interviewee put it, information and records management has to be high up on NIO’s list of priorities because of what they are dealing with – for them ‘20 years ago is now.’ We heard from more than one interviewee that the Permanent Secretary, having worked for NIO at a senior level in the past, takes a particular interest in the records of the department. The fact that the Information Management Assessment (IMA) statement of commitment was published externally is also a strong indicator of their support for information and records management. NIO is facing a huge cultural change in the next year with a move to more open and flexible working: it needs to take steps to ensure that it maintains its strong approach to information and records management and information security throughout this period and beyond. See recommendation 2.

**Setting goals for information and its management**

NIO has a draft Knowledge and Information Management (KIM) Strategy for 2015-18. It is succinct and to the point, and clearly reflects goals around the protection, management and exploitation of NIO’s information. It also includes a delivery timeline with milestones. The KIM Strategy has been approved by the DRO but not yet signed off by the Board. Sign-off has been held back to enable any key points from the IMA to be included. There is no separate IT strategy at the moment. In the future, NIO will align with the Cabinet Office IT strategy as they jointly move to a new IT platform (see section 2).

The Northern Ireland Office strategy for knowledge and information management provides a framework to:

- support regulatory compliance
- nurture a culture that values information and knowledge
- manage information throughout its lifecycle
- ensure digital continuity
- enable information risk assessment and information risk management
- define an approach to information governance.

In terms of implementation, the strategy contains a table of key objectives for delivery and a timeline of when these will be delivered. These are also reflected in the R&IM business plan for 2015-16.

NIO needs to ensure that the KIM Strategy reflects and aligns with any new IT Strategy. The KIM Strategy should also provide direction for work to address IT and cultural change, such as the updating of NIO’s information and records management. policies, guidance and training. The strategy should also say how progress against milestones is to be monitored. See recommendations 2 and 5.

Enabling public access to information and supporting transparency and re-use

NIO has well organised and robust processes in place for handling Freedom of Information (FOI) requests. NIO currently also provides a shared service for FOI to the Wales Office and the work is shared between two staff members, one of whom is based in Belfast and the other in London.

Requests come into the central FOI team but are then passed to the relevant business area. Requests are tracked using a word document saved on TRIM which, given the size of NIO and relatively low number of requests, seems sufficient. The tracking document is circulated to the Permanent Secretary on a weekly basis. The FOI team is on hand to give business areas advice and to monitor the progress of the requests. We saw evidence that FOI is taken seriously by business areas. One interviewee felt that there is a good FOI culture and a competitive attitude towards the FOI statistics. We were told that the Permanent Secretary takes an interest and people do not want to be the one to let the side down (or to be chased up to find out why). All records of FOI requests are held on TRIM. This is good practice.

NIO’s FOI figures have improved in the past year. The department received 58 FOI requests in the quarter – the fifth lowest number among departments of state. Of those received in Q3 2015, 95% met the 20-day deadline and 90% were answered ‘in time (i.e. meeting deadline or within permitted extension)’. This is an improvement on figures for Q1 (89%) and Q2 (85%), which is the minimum level set by the Information Commissioner’s Office, below which monitoring may take place. Figures were not notably different for these quarters (65 for Q1 and 61 for Q2), so variation in performance may be due to the complexity of the requests received, resourcing or a range of other issues.

In Q3 2015, 58% of resolvable requests were granted in full – this is above the average for both departments of state (46%) and for all monitored bodies (44%). 33% were withheld in full, which is just below the average for both departments of state (34%) and all monitored bodies (35%).

On 30 January 2016, there were 271 publications by the NIO on GOV.UK. This is one of the lowest volumes among departments of state. 18 are classed as FOI releases – again, one of the lower volumes among departments of state. However, 140 of these are classed as transparency data – one of the highest in percentage terms and the thirteenth highest by volume among departments of state (ahead of Ministry of Justice, Department for Transport and Department of Health, for example).

NIO has published six datasets on data.gov.uk. The website gives the department an average score for openness of 3.0 and has received a total of 18 stars.

### 1.2 Managing information as a valued asset

| Goal: The organisation protects, manages and exploits its information assets to achieve maximum value |

**Defining and cataloguing information assets**

There is no overall definition of an information asset, which can sometimes lead to confusion about what should be recorded on an Information Asset Register (IAR). However, this may not be an issue within NIO as their assets are well catalogued (see below). Nonetheless, it would still benefit NIO to define what an information asset means to the department and to include this in the documentation for Information Asset Owners (IAO). See recommendation 1.

Business areas are expected to populate an Information and Data Asset Register (IDAR – the NIO equivalent of an Information Asset Register). We were provided with the template prior to the IMA and were able to view two completed examples. Overall, the template is straightforward and includes the headings that we would expect, including business requirements and retention. The completed examples reviewed in this IMA had been populated well. We are particularly pleased to note that proportionate groupings of unstructured information have been identified as information assets, rather than just listing assets at a system level or those that contain personal data. It is unclear whether all business areas complete the IDAR in this way, but if they do then this should provide the Senior Information Risk Owner (SIRO) with the assurance that they require. **This is good practice.**

It was not clear how far the R&IM team is involved with this process. The Head of KIM and R&IM team should consider how they could use the populated IDARs to help gain a greater sense of what business areas feel to be their key groupings of information. **See recommendation 1.**

**Ownership of information assets**

The role and responsibilities of the IAO are clearly defined and they report annually to the SIRO on the security and use of their assets. The role is generally held at Deputy Director level. According to the Information Risk Policy:

> Information Asset Owners are senior individuals who command their business unit. Their role is to understand what information is held, what is added and what is removed, how information is moved, and who has access and why. As a result they are able to understand and address risks to the information, and ensure that information is fully used within the law for the public good, and provide written input to the SIRO annually on the security and use of their assets.

There is also a one-page Terms of Reference for IAOs that is slightly higher-level but is in the same vein as the above.

There is little awareness of the IAO role among staff across the organisation. Some interviewees had not heard of the role and others did not really know what the responsibilities of the IAO were. NIO would benefit from some brief communications on this, possibly via the intranet, to raise staff awareness of the role and its purpose.

See recommendation 1.

NIO has no internal training for IAOs, although two members of staff have been on The National Archives’ information assurance training. Guidance is available to IAOs but there is no formal network across NIO. NIO would benefit from creating opportunities for IAOs to share views, knowledge and approaches and from improving training provision, including making further use of The National Archives’ IAO training. See recommendation 1 2 Information and supporting technology

2.1 The technology environment

Goal: The technology environment supports the management, protection and exploitation of information

Corporate storage of information

Electronic Document and Records Management (EDRM)

The Northern Ireland Office (NIO) uses TRIM as the designated corporate system for managing its digital information and has done so since 2004, as does the rest of the Northern Ireland Administration. There are currently 1.2 million documents within the system. TRIM is a traditional EDRM and is capable of full lifecycle management including audit trail, structure, context, metadata, access restrictions, disposal, etc.

At present, disposal of digital records in TRIM has to happen manually and it is not yet possible to apply automatic disposal. However, this is not an issue with the software itself but the way the folder structure has been set up. This is being addressed through work to ‘flatten out’ the file plan by eliminating level 2 and 3 folders. Once the file plan has been simplified in this way, disposal instructions can be applied to the remaining folder structure. See recommendation 2.

Staff have ‘personal’ and ‘personnel’ areas in TRIM outside the main file plan. The ‘personal’ area is only to be used for information of use to the individual and not of corporate value, and is subject to a 50 document limit. The TRIM administration team have oversight of these. The ‘personnel’ area is for performance reviews, objectives and Human Resources documents: this is not subject to a limit. Interviewees did seem to recognise that these areas are not for saving corporate records and were generally using them for the purposes defined above. In March 2016, the NIO planned to roll out a new IT platform across the department. Whereas the department presently receives IT services from ITAC, based in the Department of Finance and Personnel (Northern Ireland), in future it will receive IT services from IT Assist (also based in the Department of Finance and Personnel) with Common Technology Services (in the Cabinet Office) in providing technical design and partnering with IT Assist. The provision of a shared IT service arises from NIO’s insistence on retaining TRIM as its EDRMS rather than moving to use Google, as the Cabinet Office has done. At present it is unclear how this relationship will work, although there are regular project meetings and it seems that there is regular and dynamic contact between NIO, ITAC, IT Assist and the Cabinet Office.

In the short term, NIO is moving from Hewlett Packard (HP) TRIM 7.1.2 to 7.3.5, and will remain on ITAC infrastructure and servers, hosted by IT assist. By the end of March NIO came off confidential (IL4) and shifted to official (IL3) and will shortly move to HP TRIM 8.3, as version 7.3.5 will be out of support in the next year. Another upgrade – to HP TRIM RM 9.0 – is due in June, which should integrate with Google. However, at the time of the IMA this was still being designed and had not been available to ITAC to test. TRIM 7.1, 7.3 and 8.3 do not support integration with Google.

As part of the move to a new IT platform, NIO will have access to Google Hangouts and other collaborative features such as Google Docs, allowing drafting and sharing. However, until HP TRIM RM 8.4 (integration between this version of TRIM and Google is still not yet proven) is introduced, any documents generated via this route will be stored in Google Drive rather than TRIM. There is major risk here that staff will not use two systems or file twice and will, as a result, move away from storing documents in TRIM. In fact there may already be a growing misapprehension that NIO will no longer use TRIM. For example, one interviewee reported hearing a Deputy Director saying that when Google came in they would be using that for their records. When told that they would still need to use TRIM, they said that they would not. Even with full integration in the future, it is likely that TRIM’s status as the main system for corporate information will have been undermined, with staff preferring to use Google Docs and Google Drive. There is also the question of whether TRIM will be available on mobile devices. This risk should be recognised and monitored as part of the risk management framework: it should be mitigated through communications, training, guidance and technical solutions, including work to enhance TRIM and make it easier to use. NIO should consider limiting access to Google Docs until integration is possible or, at the very least, give the Records and Information Management (R&IM) team oversight of Google Drive so they can monitor use. Policy, guidance and training needs to clearly state that staff must continue to store records in TRIM and managers need to support and promote this. See recommendation 2.

The move to the new IT platform will open up effective mobile working to staff through the provision of laptops, smartphones, etc. While this has many benefits, it will also be a major change for an organisation used to working in a secure environment. Some of the new apps available to staff may also raise risks in themselves: for example, an interviewee who had used Google Hangouts in the past in another government department said that it was possible to accidentally message the wrong person. Security around NIO systems has, up to now, been tight and the cultural impact of a move to a more open approach should not be underestimated. There is a risk that information could be less well protected/handled by staff than it is currently. Again, NIO must ensure that this risk is recognised and mitigated through communications, guidance, training and technical solutions. See recommendation 2.

Email

NIO currently uses Microsoft Outlook as its email system. It is straightforward to get emails into TRIM and interviewees did not raise any issues with this. There is a 90-day deletion rule for email. This policy originally came from ITAC rather than NIO itself; however, the approach was formalised via an options paper presented to the NIO Board. Shared mailboxes are currently exempt from the deletion rule. We found evidence that this was creating duplication in the Private Office and NIO would benefit from reviewing this approach. Staff we interviewed generally saw the deletion period as a positive thing that encouraged them to manage their inboxes and put important emails in TRIM. None of them confessed to consistently losing emails of importance, although there had for some been a rush to save emails when the rule was initially activated. Staff did not generally appear to be using Personal Storage Table (PST) files to store emails, which can often happen when there are deletion rules in place.

NIO will not change from Microsoft Outlook to Google Mail for the foreseeable future. A change to Google Mail has been contemplated and the newest version of TRIM is supposed to be fully compatible with Google Mail. No final decision has been made by the IT project team on which email system will be used in the long term.

**Personal drives**

Personal or ‘H’ drives exist but we saw no evidence of widespread use by staff to store corporate information. The H drive at 1 Horse Guards Road totals 13GB and at Stormont 25 GB, which is small. Staff we interviewed did not use H drives to store corporate information; in general they preferred to use their personal and personnel areas in TRIM if they did need to store documents outside the main TRIM file plan. Some used their personal areas for draft working and then transferred the records into TRIM.

**Shared drives**

Shared drives do exist as there are certain types of documents that cannot be stored on TRIM – for example, linked spreadsheets. The shared or ‘common’ drive at 1 Horse Guards Road totals 10.5GB and at Stormont is 469MB, which is small. Staff we interviewed did not generally use the shared drives for storing corporate records: in fact, some did not use them at all and others did not even know they existed. Finding, accessing and protecting information

Take-up of TRIM is better at NIO than we often see for traditional EDRM systems: this is probably largely due to the fact that NIO has, up to now, eliminated or controlled alternative areas for storing information. During the assessment we found a lot of support for TRIM from users, despite a few issues (see below). Staff generally find it easy to save documents and emails into TRIM. There was recognition that it is a good tool and that it is beneficial to keep important corporate information in a shared space. Even where interviewees had disliked it at first they reported changing their mind once they had got used to using it. A user from a policy area said that it was ‘good to be able to access historical documents’ and had asked for a link in the file plan to previous work on a Bill so they could learn from these records. One interviewee compared TRIM to an EDRM that they had used in another government department that had been difficult to search, saying that TRIM was ‘much easier to use’. This is good practice.

Practice within TRIM among staff has been patchy in the past: the R&IM team hasn’t always had the resource to tackle this, which has led to some of the issues described below. However, the introduction of the TRIM Systems Administrator role has led to a real drive to improve practice across NIO and make TRIM work better.

There is a very real risk that this good use of TRIM could be lost/damaged if full integration between Google applications is not achieved quickly or is not achieved at all (see above). See recommendation 2.

Some interviewees – though by no means all – did experience some issues around searching TRIM, reporting that it was sometimes difficult to find what they needed. In part, this is due to a lack of awareness of the advanced search capability available within TRIM or how to use this. At present it is not possible to search the content of documents in TRIM, so the success of a search is often reliant on how well a record has been titled. Interviewees reported that titling of records could be poor, with spelling mistakes or titles that were not meaningful. Future upgrades of TRIM will enable full text searching, which should help, as would reminding staff of the existing guidance on naming conventions. LIMs and the R&IM team already provide support to staff on searching TRIM and this should continue. See recommendation 2.

Access to TRIM is currently very restricted. Areas of the file plan are locked down to specific teams which can make it difficult to access information across team boundaries. According to one interviewee, ‘You used to have to make a business case as to why areas need to be locked down, but we have drifted away from this and gone back to being more locked down.’ The situation has been further complicated as access permissions have often been set at individual rather than team or group level. This raises particular issues when those individuals leave the organisation. Access privileges are not always quickly updated when people move teams, meaning that some have access to areas of the file plan that they should not. There are plans to tackle this and there is agreement that NIO should move to a more open file plan; however, owners need to be identified in order to do this and this takes time. NIO should ensure that this work is carried through to conclusion as a more open file plan will make it easier for staff to find and share information. NIO is also in the process of reviewing the classification of information in TRIM as it moves away from a confidential platform, which is positive. See recommendation 2.

2.2 The continuity of digital information

Goal: The organisation is taking proactive steps to ensure the continuity of its information, over time and through change.

Oversight of information

From a digital continuity point of view, NIO benefits from having the majority of its information in one system, TRIM. The R&IM team has full oversight of this and the TRIM Administrators play a crucial role here. However, there are other systems of which the team itself does not have direct oversight – including Microsoft Outlook, personal and shared drives – though it can obtain information from IT Assist when required. As NIO moves to a new IT environment, it needs to ensure that it can get oversight of these areas (either directly or indirectly), as well as of other systems that will available on the new IT platform. See recommendation 3.

Some information in TRIM is now over ten years old and NIO needs to monitor this information to ensure it remains complete, available and usable. Using a tool like DROID (The National Archives' file profiling tool) may help with this process (see below). It also needs to make plans for the appraisal, selection, sensitivity review and transfer of information from TRIM (see section x). See recommendations 3 and 7.

There are legacy shared drives that predate the move to TRIM in 2004. They may contain information of business or historical value that needs to be kept or may need to be transferred to The National Archives. NIO has not yet considered how it will deal with these, in terms of identifying what information the drives contain and which records are of value and need to be kept, and applying disposal: it is recommended that a strategy/plan for the shared drives is developed. As part of this, NIO would benefit from running DROID over its shared drives. This would give NIO information on the age and format of the records as well a high-level indication of what they cover. It would also help NIO to identify duplicate records. NIO also needs to develop an approach for the appraisal, selection, sensitivity review and transfer of this information (see section 4). See recommendations 3 and 7.

Digital continuity planning/IT change

The R&IM team has been consulted throughout the process of selecting a new IT platform. There has been regular contact between the Project Manager and System Administrator for TRIM throughout. NIO was also able to secure senior management support for the decision to keep TRIM. There also seems to be regular and dynamic contact between NIO, ITAC, IT Assist and Cabinet Office. NIO should ensure that this relationship continues and strengthens as its moves towards its new IT arrangement and that the R&IM team is able to contribute to IT decisions/projects that have an impact on information and records management. See recommendation 3. NIO does not yet have a plan to ensure the continuity of its digital information, either on a standalone basis or as component of wider strategy, although there are pieces of work already happening that might form part of such a strategy. NIO should define its requirements for its digital information and set out how it intends to meet these. See recommendation 3. 3 Information risk, governance and oversight

3.1 Recognising information risks

Goal: The organisation defines and manages information risks to minimise threats and maximise opportunities

Documenting and defining information risks

Section 5 of the Northern Ireland Office (NIO) Information Risk Policy defines information risk in this way:

Information risks are threats to:

i) **Confidentiality** – resulting in unauthorised access or disclosure of information;

ii) **Integrity** – resulting in inaccurate, incomplete or corrupted information; and

iii) **Availability** – resulting in authorised users being unable to access information when required.

Despite this, information risk in its wider sense is not well understood across the organisation. Many staff we spoke to thought information risks relate purely to security and protection of sensitive information rather than the issue of information availability. While it is positive that the importance of security and protection of information is recognised, NIO should build on the definition above to provide a more detailed description of information risk, with examples, and communicate this to staff, particularly Information Asset Owners (IAO) and Project Managers. NIO would benefit from exploring what other government departments have done here, in particular the Home Office. See recommendation 4. According to the Departmental Risk Management Policy:

Key risks at departmental and strategy levels will be recorded in risk registers according to the specified template. Registers will include details of the impact and likelihood of each risk identified, indicate ownership and specify an action plan for implementation. Risk Registers should also record residual risk taking into account the effect of action taken.

Information-related risks are included on the Business Delivery Group business plan for 2016-17. However, we found little evidence to suggest that information risks are routinely documented across the department; NIO needs to ensure that information risks are being identified and recorded as part of the risk management process. See recommendation 4.

Implementing an information risk management approach

NIO has an Information Risk Policy (IRP) and this is currently under review. The Senior Information Risk Owner (SIRO) appeared to take their responsibilities seriously and had asked for a specific objective relating to this role. They also felt it was important to ensure that sufficient time was allocated to the role.

According to the IRP:

1.4 Risk ownership resides at the very top of the NIO with the Senior Information Risk Owner (SIRO) on behalf of the NIO Management Board owning the information risk. All Directorates and Arm’s Length Bodies (ALBs) must have an Information Asset Owner (IAO) who will own and take responsibility for all information risks within their business area. The IAO reports quarterly to the Departmental Security Committee (DSC) their risk management decisions, which may be escalated to the NIO Management Board through the Audit Committee. 1.5 Risk management involves everyone in the NIO, the Corporate Governance Unit, the Information Assurance Coordinator and the Information Risk Guidance policy will provide practical advice and guidance on the implementation of an effective risk management process.

1.2 Information risk management as defined in this policy is a continuous process which lasts for the whole lifecycle of the information (electronic and paper), by preparing quarterly risk assessments for each business area. This enables the SIRO to prepare their annual information risk report, and the Director General’s [now Permanent Secretary] Statement of Internal Control (SIC).

The main risk register is largely focussed on political risks and the expectation is that information risk will generally be managed below Board level. In addition, while the Knowledge and Information Management (KIM) team has a risk register in place, this focuses on risks relating to service delivery rather than wider risks to NIO stemming from a failure to capture or keep the right information.

IT risks are currently managed within the IT change project: although information and records management considerations have been key drivers for decisions taken, information and records management or cyber-related impacts are not clear from project risk descriptions. We saw limited indication that these risks were present on departmental risk registers or being raised by IAOs.

There are some serious risks to the availability and security of NIO’s information around the move to more flexible and open working. This could have an impact on the security of NIO’s information and its ability to manage its information (see section 2). These risks must be monitored and mitigated as part of the NIO risk management framework. An information security Board-level briefing, which The National Archives will provide, is also recommended to help raise awareness of information risk and information security, including cyber threats. See recommendation 4.

NIO has an Information Assurance Coordinator (IAC). This role is currently being covered part-time by one of the FOI staff. The IAC has responsibility for completing the annual security health check for the Cabinet Office. It is also their responsibility to remind staff to do the Responsible for Information e-learning. The IAC sends out a request to Deputy Directors and asked them to cascade across the core department and Arm’s Length Bodies (ALBs).

Information and records management was subject to an audit in March 2014 – carried out by Roger Smethurst of the Cabinet Office – which was positive. This reported that:

NIO’s record keeping is strong in both electronic and paper records management. On the whole, its implementation of electronic records management compares very favourably to other government departments. In particular there is a good culture of record keeping and very favourable evidence of records capture. However, there are also patches of non-compliance, unfortunately more noticeable at a senior level.

There are significant opportunities to improve records search linked to (a) an over burdensome access control model, (b) a bloated, unwieldy and out-of-date file structure, (c) a lack of understanding across the department of the ability of the records team to conduct more thorough, complete and detailed searches which means that their skills and access rights are under-utilised; and (d) a need to re-introduce and maintain more searchable titles for documents and records.

User training, better online guidance or desk aids, induction and leaving processes are also areas for improvement. Whilst operational delivery of records management is largely sufficient (save for some possibilities for short-term resource), strategic and policy leadership for records management across the department is missing.

NIO has taken the report very seriously and the Records and Information Management (R&IM) Team Plan for 2015-16 includes actions to address the recommendations. Evidence of ongoing work in all these areas has been identified during this IMA.

### 3.2 Establishing control

**Goal:** The organisation has effective governance structures in place that foster communication and strategic planning

#### Governance structures

There are no formal boards to support communication and collaboration between information management, information assurance and IT colleagues. In a small department like NIO a formal board may not be required, provided there is regular cross team communication. We gained a reasonable level of assurance that Knowledge and Information Management (KIM), IT and information assurance professionals are currently working together as needed, in an effective manner. For example, the R&IM team has been consulted throughout the process of selecting a new IT platform and there are regular project meetings; there appears to be good contact between NIO, ITAC, IT Assist and Cabinet Office colleagues.

#### Supporting the business

The Information Management Policy clearly sets out the responsibilities of the R&IM team, which are to maintain corporate paper and electronic records and information systems (TRIM), ensure capture and transfer of the public record and support staff through training and guidance. The team consists of eight staff overall plus three part-time reviewers. Currently the team is focusing on:

- ensuring NIO compliance with statutory requirements
- supporting shared service for FOI
- delivering high-quality information management services to support department business
- supporting knowledge capture and access.

The following projects are listed in the R&IM Business Plan 2015-16:

- implement the Recommendations from the Smethurst Review
- develop and communicate a strategic plan to underpin effective information management training and implementation
- progress Information Maturity Model, in collaboration with ITC and Information Assurance
- overhaul the Corporate File Plan to facilitate broader end-user access
- devise a roadmap for the review and transfer of digital records before 2020
- prepare for The National Archives’ Information Management Assessment.

Following on from recommendations of the audit in 2014, the Departmental Records Officer was able to successfully secure additional resource. This included defining a more strategic role at Band A level, with responsibility for information and records management policy and guidance, and a role to provide additional support for TRIM. Currently these roles are time-limited (two years); NIO must ensure that it retains this resource (the draft KIM strategy asks that these roles be extended for another two years) as it upgrades TRIM and moves towards a new IT environment in order to support planning and ensure successful implementation. See recommendation 5.

At the time of the IMA, the R&IM team was about to take on an apprentice at Band E for 18 months. This approach has already been successfully tried in the FOI team, providing additional resource for the team and career development opportunities. **This is good practice.**

The interviews revealed a lot of support for the R&IM team and the service that they provide. Staff felt that they could either pick up the phone to get help, or just pop over to speak to someone from the R&IM team. The TRIM administrator, along with their colleague, prioritises requests for help from the business, dealing with them quickly and effectively. **This is good practice.**

There is a clear plan in place for KIM. The KIM strategy includes an action timeline of all activities for 2016 and this is reflected in the R&IM business plan.

**Support networks**

NIO has Local Information Managers (LIM) within business areas. They are usually at Executive Officer (EO) level, although some are Higher Executive Officers (HEOs). According to the LIM Training Handbook

They play a crucial role in the Northern Ireland Office. The success of the EDRMS depends largely on LIMs making logical decisions in regard to the creation, titling and content of electronic folders, sharing (or restricting) access to information, closing folders and reducing duplication.

Their main responsibilities are to:

- be the first point of contact for end users on issues relating to folder creation, storage and retrieval; and on efficient distribution of information within the team/division

- apply the policies and procedures that relate to the use of the corporate file plan and EDRM effectively within the team/division

- identify local information and record management training needs

- liaise with R&IM about requests and queries about any of the above. They need the following skills:

- strong knowledge of his/her business unit’s role

- ability to disseminate Information Management policy and procedures within their business unit

- ability to network with other Local Information Managers and Record Managers at Forums and other events

- IT proficiency

- good working knowledge of the Corporate File Plan and its structure, which is based on functions, activities, and transactions

- understanding of how to name, store, and retrieve electronic information, and how to manage existing paper files

- knowledge of the record management functionality of the EDRM software (HP TRIM context)

- ability to identify and react to local problems relating to the Corporate File Plan; ability to articulate points of view and put requests to R&IM.

It was not clear whether these responsibilities are consistently included in annual performance agreements for LIMs. NIO should encourage line managers and their LIMs to do this to ensure that the important work LIMs are doing is recognised and that they received appropriate credit for this. See recommendation 5.

Most of the LIMs we interviewed were conscientious and proactive in their role. They were carrying out activities such as opening and closing folders, providing advice on how to save or open documents, helping colleagues to search TRIM and assisting with access permissions. One went a bit further than this, telling their team ‘why they should keep good records’, asking them to title things properly and tackling ‘repeat offenders.’

As well as the LIM handbook, the R&IM team provide training for new LIMs. LIMs we interviewed said they are easily able to go and speak to fellow LIMs on issues when they need to, although they did not appear to be aware of any forums specifically for LIMs. In addition, the LIMs we spoke to had good contact with the R&IM team, in particular the TRIM administrators, and could get the help and support they required.

The role of LIMs will become even more important in the move to a new IT platform, in particular in helping to promote and monitor use of TRIM and in monitoring use of new systems such as Google Docs and Google Drive. There are plans to assess the role of the LIM and training needs in order to strengthen the role. There are also plans to introduce LIM forums, which would be a very positive step. All LIMs should receive training in new versions of TRIM and other systems as necessary, should be made aware of updated guidance, and should promote this to staff in their business areas. See recommendation 5.

### 3.3 Providing direction

| Goal: The organisation gives staff the instruction they need to manage, protect and exploit information effectively |

#### Knowledge and Information management policy and guidance

NIO has an up-to-date, clear, succinct and easy-to-read Information Management Policy that covers information management, information security, information governance and managing corporate knowledge. It clearly sets out responsibilities for information management across NIO and also states guiding principles:

- Northern Ireland Office recognises and values information as a corporate asset.
- We manage information to support business needs
- We maintain information to meet our statutory obligations
- We identify information for preservation of the historic record
- We do not keep information longer than required
- We recognise and manage information risk. Annex B of the policy covers what type of information should be kept and where. It also includes a helpful statement about the record status of email:

The same rules apply to email as to any other form of correspondence. Attachments to email are often important documents. It is for the individual to decide if an email and/or attachments meet the criteria for retention, depending on their business content, context and importance.

This is good practice.

Other information and records management guidance is available in the Records Management area of the NIO intranet: it is easy to find and not buried at too low a level. The guidance covers subjects like FOI ‘how to’s’, how to use TRIM, naming conventions and the work of LIMs.

When we viewed the intranet, both FOI and Records Management were appearing in the list of most active pages, suggesting that staff access these regularly. The R&IM team are also able to put messages regarding information and records management in the news feed. For example, it has included a reminder to complete the Responsible for Information e-learning. The team also writes a blog that communicates key messages in an entertaining, engaging and humorous way. Recent posts included one on FOI entitled The excitement of statutory compliance and another on the work they are doing in TRIM: Flattening the file plan – the impossible dream. This is good practice.

Staff we interviewed are generally aware of the guidance but don’t necessarily refer to it that often. When pressed on this, several said that they are able to get good and timely advice from LIMs and from the R&IM team when they need it. There are plans to refresh the guidance; NIO would benefit from reminding staff about its existence and promoting it, possibly through communications on the NIO intranet and via LIMs. See recommendation 5. NIO is facing a significant cultural change as it moves to a new IT environment and more flexible and open working. It is essential that guidance is updated to reflect this and is communicated and promoted to staff. For example, the information management policy needs to make it clear that staff still need to save records to TRIM rather than keeping them in Google Drive, as well as clearly setting out how Google should be used. Guidance around the security and protection of information needs to include clear rules around the use of mobile technology and on working outside the office. See recommendation 5.

What to Keep

The Information Management Policy sets out at a high level what records should be kept:

We should retain information that is used to support and inform decision making; for example, project documentation or evidence supporting policy development. Other examples include:

- submissions to senior management and to ministers and their responses
- Terms of Reference, Memoranda of Understanding and other agreements; committee papers, records of meetings, reports
- correspondence, consultations/discussions with external stakeholders
- official correspondence; Parliamentary business; FOI & Data Protection (DPA) requests & responses
- memos, internal records of business discussions and records of commercial transactions.
- financial information; Human Resources and management information.

In addition, every business area has a retention schedule listing key records that need to be kept and for how long. These are developed jointly between the R&IM team and the business area. Staff interviewed do not really use the guidance or the retention schedules to help them decide what to keep and tend to rely on their own judgement to decide what documents to save on TRIM. However, the staff interviewed do seem to be making sensible decisions about what records to keep. An example of good practice is the Secretary of State’s Private Office box papers, which include keeping submissions, letters and policy advice/issues. Any papers with comments are scanned into TRIM; emails are also saved to TRIM so there is a clear record of decisions. There does seem to be a strong record keeping culture at NIO, to the point where the department probably keeps too much rather than too little. NIO may benefit from reminding staff about the high-level guidance on what type of records to keep, possibly through communications on the NIO intranet and via LIMs. See recommendation 5.

NIO does not appear to have published its retention schedules, as recommended in Sir Alex Allan’s Report on Records Review and The National Archives’ guidance, and it should work towards doing this. See recommendation 5.

Providing training

At present, responsibility for induction training in the basics of information and records management rests with line managers. However, it is unclear whether this routinely takes place and, if it does, whether a consistent message is being conveyed. NIO should review this practice to see how well it is working and consider what additional support it can provide to line managers and LIMs. See recommendation 5.

The R&IM team has been providing TRIM training. Feedback on this from staff we interviewed is positive: most find it useful and helpful. TRIM training will continue to be provided, as will training on Microsoft Office and Google. However, it has become increasingly difficult to run the TRIM training due to insufficient facilities. In particular, there were problems with the IT set up, both in Belfast and London. This has led the Systems Administrator to provide one-to-one sessions as required instead, although they felt this was too labour-intensive to be a long-term solution. The move to a new IT provider and provision of new and better laptops should ease this problem. NIO needs to ensure that adequate facilities are provided for the training going forward, as this will be crucial in staff acceptance of new versions of TRIM. See recommendation 5.

### 3.4 Measuring impact

**Goal:** The organisation measures performance in practice and takes informed risk-based action as a result.

#### Measuring compliance with policy

At present, there is no formal process for monitoring whether business areas are complying with information and records management policy. However, the draft KIM strategy mentions planned audits on records creation by business group, the information survey and monitoring of the use of retention schedules by LIMs: all of these will help NIO to measure compliance. At present, statistics gathered largely centre around TRIM use rather than email or the shared and personal drives. As NIO moves to its new IT arrangement, it will become increasingly important to monitor staff use of existing systems as well as newly-available applications such as Google Docs and Google Drive. This would enable the R&IM team to react to any issues quickly – for example, if a business area is saving all its records in Google rather than in TRIM. NIO should consider exactly what statistics it needs and ensure that it has arrangements in place for ITAC and Cabinet Office to provide these. See recommendation 2.

Currently there is no regular assessment or benchmarking process, and NIO does not yet have anything that gives business areas a sense of what good performance looks like in information and records management, such as a maturity model. In terms of benchmarking, NIO would benefit from looking at the approach of other departments, in particular HM Treasury; however, as a small department, we recognise that NIO would need to develop an approach to fit its own circumstances. See recommendation 5. 4 Records, review and transfer

4.1 Oversight of records and selection

Goal: The organisation understands the value of its records and can consistently identify those with enduring historical value.

Position of the Departmental Records Officer (DRO)

The DRO is a senior level post within NIO. The current DRO is Deputy Director for the Business Delivery Group. As a result, in practice the DRO duties are delegated to the Head of KIM and carried out by the R&IM team. The DRO and their team are fulfilling all aspects of the role as set out in The National Archives’ guidance. The Senior Information Risk Owner (SIRO) is the DRO’s line manager and they appear to have a good working relationship.

Priorities for the DRO currently centre on the move to a new IT platform and more flexible and open working: particularly the challenges this raises in ensuring that the good culture of records management and information security is maintained, and that the success of TRIM as the designated corporate system for Electronic Records Management (ERM) continues (see also section 3.2).

At a time where posts are being cut within the Business Delivery Group, the DRO has managed to increase resource within the R&IM team. At present, the team is able to carry out the work described above successfully; NIO needs to ensure that this continues. See recommendation 5

Oversight, control and use of records

NIO appears to have good oversight and control of its paper records, which are stored with Iron Mountain. The R&IM team recently carried out an audit of everything kept by Iron Mountain and cross-checked this with paper files listed on TRIM. According to one member of the team, ‘Everything is where it is supposed to be now.’ Most staff interviewed do not really need to access paper records often, with the majority of information needed stored on TRIM. When one interviewee does need to access paper files, they are able to obtain the files easily and find the information they need.

According to the Government and Remote Services Department at The National Archives (which oversees the requisition of accessioned records back to departments), the team has a good working relationship with NIO and there are no significant issues to report in terms of business-as-usual requisitions, outstanding or misplaced records with this department.

There are a number of Inquiries having an impact on NIO at present: these require access to the department’s records, including a small amount (six at the time of the IMA) requisitioned from The National Archives via Government and Remote Services. Depending on circumstances, originals or copies are provided. In some instances originals are demanded (e.g. for the Criminal Cases Review Commission). DRO approval is required to send documents outside the department: locations are updated in TRIM and the business area responsible is sent periodic requests on the status of loaned files.

NIO has provided accurate figures for the twice-yearly Records Transfer Report.

**Appraisal and selection**

NIO has three very knowledgeable and experienced part-time file reviewers. They are all former senior civil servants and have a deep and nuanced understanding of the issues and potential sensitivities. Appraisal decisions are quality-checked by the Head of R&IM. The National Archives’ Information Management Consultant (IMC) recognises the standard of NIO’s appraisal and selection work as ‘excellent’ and is generally able to approve selection decisions without need for re review. **This is good practice.** Appraisal of paper records is currently carried out using a file-by-file approach, reading each file to make a decision on whether it is of historical value or not. This method of appraisal is time-consuming. NIO reviewers stated that the volume of files for review is increasing. The end of the practice of first review (files reviewed five years after closure to see if they are of continuing value) in the late 1980s means that low-value material is no longer being weeded out. Pair this with the requirement to review two years’ worth of material every year to keep pace with the transition to the 20-year rule, and NIO is facing a major challenge.

NIO needs to consider how it can streamline the appraisal process and make it more efficient. It is starting to explore the possibility of a more macro approach using Series Level Appraisal Questionnaires: it should engage with its Information Management Consultant, who will be able to provide further advice and put the department in touch with other government departments who have tried this approach. See recommendation 6.

At present, there are no documented criteria for selection to help determine what is of historical value and should be selected for preservation at The National Archives. The process is very much reliant on the knowledge and experience of reviewers; NIO needs to think about how it can capture the knowledge of these reviewers and document its selection criteria to ensure that the process continues smoothly in the future. It should liaise with its IMC, who will be able to provide further advice and support on this. See recommendation 6.

NIO recognises that file-by-file review will not be sustainable for digital information and doesn’t feel that it currently has the skills to carry out digital appraisal. NIO needs to develop an approach for the appraisal and selection of digital information. This should include consideration of the legacy information on the shared drives that predate TRIM, and also ensuring that the team has the right skills. It should also sign up for The National Archives’ digital transfer training. See recommendation 7. 4.2 Implementing disposal decisions

Goal: The organisation understands the process for records disposal and consistently implements decisions in line with defined plans

Triggers for disposal

Paper records are identified for disposal through retention/disposal scheduling and through the annual appraisal and selection processes. Destruction of registered files must be signed off by the Head of Records and Information Management. TRIM is updated to show the status of destroyed records. Signed review sheets authorising destruction are retained. Secure on site shredding is used to destroy files.

At present, disposal from TRIM has to be carried out manually. Files for disposal are tagged and this is then carried out by the TRIM Administrator. NIO is working to address this issue by simplifying the file plan so disposal instructions can be applied (see section 2.1).

Sensitivity review

The knowledgeable and experienced former civil servants mentioned in section 4.1 also carry out sensitivity review of paper records. The process is time-consuming – they read files from ‘cover to cover’. However, it would be hard to streamline or speed up the process as even the most innocuous records can have sensitivities. The type of sensitivities found within NIO records – in particular around national security, international relations and ‘legacy issues’ – are likely to be current for decades and the impact of release potentially severe (for example, loss of life if names of informants or agents are revealed). The team estimates that they are able to release around 90% of files with redaction rather than having to close the whole file. Given the sensitivity of the information it holds, NIO should ensure that it continues to allocate appropriate resource to this work. See recommendation 6. NIO uses a number of pieces of guidance to inform sensitivity review. These include The National Archives’ guidance and Cabinet Office Guidance on Security and Intelligence Related Records – ‘The Red Book’ – which contains some guidance specifically relating to Northern Ireland matters, as well as some internal notes. Again the process is, at least in part, dependent on the knowledge and experience of current review staff. NIO should ensure that it captures the knowledge of these staff members where it isn’t already included in existing guidance. See recommendation 6.

The quality of NIO’s closure applications to the Advisory Council is generally good. A significant number of applications are submitted, with few challenges from the Advisory Council. The team receives useful advice and feedback from the Schedule Application Manager at The National Archives.

NIO has not yet started to develop an approach for the sensitivity review of digital information and needs to acquire new skills to deal with this. NIO should follow the work that The National Archives and other government departments are doing on digital sensitivity review, particularly around tools to assist the process, and should start to plan and develop an approach. A good starting point would be the research report on The application of technology-assisted review to born-digital records transfer, Inquiries and beyond recently published by The National Archives.¹ See recommendation 7.

Transfer and planning

NIO is currently slightly behind in its transition to the 20-year rule. At the time of the IMA, it was reviewing files for 1989, had transferred files up to 1986 and files for 1987-88 were at the preparation and Advisory Council stage. The Head of R&IM considered NIO to be around three to four months behind the ideal transfer time for the year. The increase in volume of paper files from the late 1980s onwards will exacerbate this issue and NIO could fall further behind as a result (see section 4.1). NIO is starting to think about how to address this and has put together a spreadsheet

¹ nationalarchives.gov.uk/information-management/manage-information/policy-process/reviewing-digital-records-management-government/research/ to work out how to catch up: the plan is to take this to the Advisory Council for approval. NIO has also been liaising with the Foreign and Commonwealth Office (FCO) to find out more about their approach. NIO should also liaise with its IMC on this, who will be able to provide further advice and support. See recommendation 6.

NIO has not yet developed an approach for the appraisal, selection and sensitivity review of digital information, although it is starting to prepare a roadmap. It is important that NIO starts to plan for this, starting with legacy information on the shared drives that predate TRIM. NIO has attended The National Archives’ Digital Transfer User Group meetings: it should to continue to engage with and learn from The National Archives’ and other government departments’ experience. NIO should also sign up for the new Digital Transfer Training at The National Archives. See recommendation 7.